chore(guard): sync vendored public-repo-guard to canonical

[wave-av-release-bot]

Syncs the vendored public-repo-guard trio to the canonical source in wave-foundation/scaffolder/public-repo-guard.

• adds the internal-ip leak rule (Tailscale-CGNAT 100.64.0.0/10), lockstep with the pre-publish mirror gate
• reconciles accumulated drift in the vendored copy

Each changed file is byte-for-byte identical to canonical (verified by git blob SHA). The repo's own Secrets + content policy gate re-scans this PR.

🤖 Generated with Claude Code

---

Note

Update public-repo-guard workflow to use actions/checkout v7 without persisted credentials

Syncs public-repo-guard.yml to the canonical version. Upgrades actions/checkout from v5.0.1 to v7.0.0 and sets persist-credentials: false so the GITHUB_TOKEN is no longer stored in the repository's Git config after checkout.

^{Macroscope summarized 87dc447.}

---

Summary by cubic

Sync the vendored public-repo-guard with its canonical source, making the files byte-for-byte identical. Adds the internal-ip leak rule (Tailscale 100.64.0.0/10) and updates the workflow to actions/checkout v7 with persist-credentials: false to avoid persisting a token during scans.

^{Written for commit 87dc447. Summary will update on new commits.}

[greptile-apps]

PR author is in the excluded authors list.

[macroscopeapp]

Approvability

Verdict: Needs human review

Unable to check for correctness in 87dc447. This PR updates a GitHub Actions workflow with a security hardening change (newer checkout action + persist-credentials: false). However, the file is owned by wave-av/streaming-team and the author (a bot) is not a designated owner, so the team should review to confirm this sync is expected.

^{You can customize Macroscope's approvability policy. Learn more.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Checkout action pin now diverges across workflows (v4.3.1 / v6.0.3 / v7.0.0)

Other workflows in this repo still pin older checkout releases: .github/workflows/_checks.yml:23,54,114 use v4.3.1 and .github/workflows/go-lint.yml:16 / .github/workflows/governance-enforce.yml:27 use v6.0.3, while this file jumps to v7.0.0. Three different pins increase maintenance/audit surface; a follow-up to unify them (and apply the same persist-credentials: false hardening where no step pushes) would be worthwhile. I could not verify offline that the pinned SHA 9c091bb... truly corresponds to the v7.0.0 tag — the comment should be double-checked against the upstream tag.

---

Was this helpful? React with 👍 or 👎 to provide feedback.